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AUDITOR  OF  THE  COMMONWEALTH 

STATE  HOUSE,  BOSTON  02133 
A  JOSEPH  DENUCCI  TEL  (617)  727-2075 

AdDlTOR 

91-213-9  dec;,  -jggj 

"""IJI^^' 'v/assacwisetts 

Joseph  Duffey,  Chancellor  March  20,  1991 

University  of  Massachusetts  at  Amherst 
VThitmore  Administration  Building  -  Room  374 
Amherst,  Massachusetts  01003 

Dear  Chancellor  Duffey: 

In  accordance  with  Chapter  647  of  the  Acts  of  1989,  we  reviewed  the 
internal  controls  over  the  Department  of  Public  Safety  (DPS)  payroll  accounts 
located  at  the  University  of  Massachusetts  at  Amherst  (UMA).  Our  review 
covered  the  period  December  1,  1987  to  June  30,  1990,  with  particular  emphasis 
on  the  period  March  14,  1988  to  April  19,  1990,  during  which  time  thefts  of 
DPS  payroll  funds  occurred. 

DPS,  which  has  the  functional  responsibility  for  the  campus  police  and 
related  security  services  of  UMA,  is  under  the  jurisdiction  of  the  Vice 
Chancellor  for  Student  Affairs.  Accordingly,  DPS  operates  under  the  general 
procedures  and  guidelines  formulated  for  the  overall  administration  of  UMA. 

We  conducted  our  review  in  accordance  with  generally  accepted  government 
auditing  standards.  In  order  to  conduct  our  review,  we  interviewed  DPS 
personnel,  university  internal  auditors,  and  other  UMA  personnel.  We  limited 
our  audit  scope  to  a  review  of  the  work  performed  by  the  internal  auditors  and 
of  related  DPS  payroll  records/procedures. 
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The  results  of  our  audit  disclosed  inadequate  internal  controls  over  DPS 
payroll  which  contributed  to  the  conditions  that  permitted  the  falsification 
of  payroll  records  and  the  subsequent  theft  of  approximately  $14,000  in 
payroll  funds.  The  disclosures  include  (1)  ineffective  payroll  procedures, 
including  inadequate  segregation  of  duties,  improper  certification  of 
payrolls,  and  an  improper  check-distribution  system;  (2)  the  lack  of  specific 
guidelines  or  instructions  concerning  departmental  payroll  procedures;  (3)  the 
lack  of  monitoring  procedures  to  determine  compliance  with  the  UMA's  payroll 
requirements;  and  (4)  the  State  Board  of  Retirement  not  being  notified  and  the 
university's  bonding  company  not  being  promptly  notified  of  the  loss.  These 
areas,  including  our  recommendations  for  their  resolution,  are  detailed  in  the 
attachment . 
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ATTACHMENT 

Internal  Controls  over  Department  of  Public  Safety  Payroll  Accounts 

The  University  of  Massachusetts  at  Amherst  (UMA),  responding  to  the 
requirements  contained  in  Chapter  647  of  the  Acts  of  1989,  notified  the  Office 
of  the  State  Auditor  of  a  falsification  of  payroll  records  and  a  subsequent 
theft  of  funds  from  UMA's  Department  of  Public  Safety  (DPS)  special  officers 
account  and  the  Security  Services  Office  (SSO)  student  trust  payroll  account. 
These  accounts  are  funded  through  general  appropriations  and  trust  funds  of 
UMA.  We  reviewed  and  evaluated  the  system  of  internal  controls  governing  the 
payroll  activities  disbursed  through  these  accounts. 

The  results  of  our  review  disclosed  that  inadequate  internal  control 
procedures  contributed  significantly  to  the  conditions  that  led  to  the  thefts 
of  about  $12,000  f  rom  the  DPS  special  officers  account  and  of  about  $2,000 
from  the  SSO  student  payroll  account. 

DPS  special  officers  are  individuals  who,  after  completing  a  prescribed 
training  program,  are  employed  for  special  police  work.  These  special 
officers  can  be  university  employees  or  other  persons  who  have  completed  the 
training  program.  University  employees  have  their  special  officer  earnings 
added  to  their  regular  university  payroll  check,  whereas  other  employees 
receive  a  check  for  services  rendered  while  employed  as  a  special  police 
officer.  The  SSO  student  payroll  is  for  students  who  are  hired  as  security 
guards  for  various  UMA  buildings.  These  students  may  function  as 
receptionists,  supervisors,  or  escorts. 

Details  covering  the  disclosures  in  our  review  are  shown  below. 

Payroll  Procedures;  UMA's  Payroll  Policies  and  Procedures  Manual 
generally  provides  for  the  segregation  of  payroll  duties  of  the  payroll 
preparer  and   the  approving  authority.     Additionally,   proper  payroll  internal 
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controls  based  on  sound  business  practices  provide  that  payroll  checks  should 
be  distributed,  approved,  and  verified  by  individuals  other  than  the  payroll 
preparer. 

Contrary    to    these   policies   and   sound   business    practices,    the  following 

conditions  were  noted: 

o  The  individual  who  prepared  the  payroll  was  also  involved  in  the  check- 
distribution  process.  Upon  DPS's  receipt  of  the  payroll  checks,  the 
preparer  would  give  them  to  a  police  dispatcher  for  employees  to  pick 
up.  A  sign-out  system  indicating  the  receipt  of  checks  was  loosely 
maintained.  Employees  would  acknowledge  having  received  their  checks  by 
signing  a  check  sign-out  (receipt)  form.  The  sign-out  form  contained 
the  names  of  all  special  officers,  whether  entitled  to  a  payroll  check 
or  not,  as  well  as  those  of  the  department's  regular  employees.  No 
verification  was  made  by  a  second  party  to  ensure  that  the  individual 
picking  up  the  check  was  the  individual  who  signed  the  receipt  form. 
Further,  provisions  were  not  established  to  return  unclaimed  checks  to 
the  payroll  department. 

o  The  individual  responsible  for  approving  the  payroll  did  not  verify  or 
check  on  a  test  basis  the  daily  roll-call  sheets  or  the  time  sheets  to 
ensure  that  the  individuals  listed  on  the  payroll  worked  the  hours 
designated.  In  our  discussion  with  the  responsible  individual,  we  were 
informed  that  relisince  for  the  accuracy  and  reliability  of  the  payrolls 
was  placed  on  the  payroll  preparer.  Consequently,  he  did  not  feel  it 
necessary  to  question  the  authenticity  of  the  payroll. 

o  The  payroll  preparer,  in  the  absence  of  the  individual  responsible  for 
approving  the  payroll,  was  permitted  to  approve  the  DPS  special  officer 
payroll . 

Payroll  Guidelines  or  Instructions:  DPS  does  not  have  written  guidelines 
concerning  its  specific  payroll  processing  functions.  Such  guidelines  are 
needed  to  designate  the  areas  of  responsibilities  concerning  its  time  keeping 
records,  payrolls,  approving  authority,  and  check  distributions.  UMA ' s 
Payroll  Policies  and  Procedures  Manual  includes  general  payroll  requirements 
for  its  central  payroll  department.  Although  this  manual  is  deemed  adequate 
for  general  payroll  purposes,  more  specific  guidelines  are  needed  to  cover  the 
payroll  duties  and  responsibilities  at  the  departmental  level.  Without  such 
guidelines,   the  specific  payroll   functions  of   the  various   payroll  processing 


activities  are  not  formally  defined. 
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Monitorinp  Procedures;  UMA,  either  at  the  central  or  DPS-departmental 
level,  did  not  have  any  monitoring  procedures  to  ensure  compliance  with  its 
payroll  requirements.  In  accordance  with  existing  procedures,  each  department 
operates  autonomously  without  being  monitored  by  either  UMA's  central  payroll 
division  or  the  Office  of  the  Vice  Chancellor  for  Student  Affairs,  which  has 
jurisdiction  over  DPS.  Accordingly,  departmental  payroll  activities  remain 
the  responsibility  of  the  department  head,  the  Chief  of  Police.  This 
responsibility  was  further  delegated  by  the  Chief  of  Police  to  an 
administrative  supervisor.  As  previously  noted  in  this  report,  no  checks  and 
balances  concerning  payroll  internal  control  procedures  were  evident  at  this 
level,  since  reliance  for  the  various  activities  was  placed  on  the  individual 
performing  the  functional  duties. 

Bonding  Company;  The  absence  of  effective  internal  administrative  control 
practices  is  clearly  illustrated  by  the  inability  of  the  university  to  take 
prompt  action  to  initiate  a  claim  with  its  bonding  company.  The  university 
has  a  $500,000  honesty  blanket  bond  to  cover  fraudulent  or  dishonest  acts  by 
its  employees.  The  conditions  of  the  blanket  bond  clearly  state  that  the 
bonding  company  should  be  notified  of  the  loss  within  30  days  of  its 
discovery.  Until  our  inquiry,  the  university  treasurer  had  not  initiated 
action  to  recover  the  loss  from  the  bonding  company.  However,  because  the 
30-day  period  had  passed,  the  bonding  company  did  not  honor  the  belated  claim, 
resulting  in  a  loss  of  about  of  $12,000  to  the  Commonwealth  and  of  $2,000  to 
the  university. 

State  Board  of  Retirement;  UMA  had  not  taken  appropriate  action  to 
contact  the  State  Board  of  Retirement  concerning  the  possible  attachment  of 
the  available  retirement  funds  of  the  employee  who  resigned  after 
acknowledging   responsibility   for   the   stolen    funds.      In   our   discussions  with 
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UMA  Human  Resource  officials,  we  were  advised  that  the  attachment  action  was 
not  pursued,  because  they  were  unfamiliar  with  the  circumstances  surrounding 
the  employee's  resignation.  The  appropriate  UMA  personnel  should  have  been 
promptly  apprised  of  these  circximstances  so  that  the  State  Board  of  Retirement 
could  have  been  contacted  concerning  the  feasibility  of  seeking  the  attachment 
action. 

The  disclosures  cited  in  this  letter  require  immediate  action  by  UMA  to 
resolve  the  inadequate  payroll  internal  controls.  The  resolution  of  these 
inadequacies  requires  improvement  in  the  present  system  of  internal  controls. 
Such  controls  are  needed  to  safeguard  assets  and  to  ensure  that  departmental 
procedures  are  in  compliance  with  UMA  policies.  In  addition,  strong  internal 
controls  serve  as  a  deterrent  to  illegal  acts  or  to  the  concealment  of  errors. 

Subsequent  to  our  audit,  responsible  UMA  officials  informed  us  that  DPS 
has  begun  to  strengthen  its  internal  controls  by  requiring  the  individual 
approving  the  payroll  to  use  the  daily  roll-call  and  time  sheets  for 
verification. 

Recommendation ;  The  university  should  improve  its  system  of  internal 
controls  by: 

1.  Strictly  segregating  the  duties  of  the  preparer  and  approver  of 
payrolls.  These  individuals  should  not  have  access  to  the  payroll 
checks.  The  custodian  of  the  checks  should  maintain  a  payroll  sign-out 
(receipt)  form  that  lists  only  the  names  of  those  employees  entitled  to 
a  check  and  verify  that  the  individuals  picking  up  checks  are  the 
persons  who  signed  the  receipt  form.  Checks  not  picked  up  within  three 
days  should  be  returned  to  the  central  payroll  administration  office 
for  mailing  or  other  disposition. 

2.  Having  central  payroll  administration  prepare  written  generalized 
departmental  policies  that  will  provide  the  framework  for  each 
department  to  establish  written  payroll  policies  and  procedures. 

3.  Requiring  that  departments  be  periodically  monitored  to  ensure 
compliance  with  established  payroll  policies  and  procedures. 

A.  Instituting  prompt  action  to  notify  the  university  treasurer  when  a 
loss   of   funds   is   detected   so   that   the   treasurer   can   promptly  contact 
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the  bonding  company.  Similar  action  should  be  taken  to  notify  the 
State  Board  of  Retirement  in  those  cases  where  the  attachment  of 
retirement  funds  may  be  necessary. 

Auditee's  Response:     The  Vice  Chancellor  of  Administration  and  Finance  for 

the  Amherst  campus  responded  to  the  audit  report's  recommendations,  as  follows: 

1.  Section  514  of  the  Payroll/Personnel  Policies  and  Procedures  Manual 
generally  addresses  these  issues,  and  specifically  identifies 
procedures  for  distribution  of  paychecks  and  the  return  of  checks 
that  cannot  be  distributed. 

As  of  May  1990,  the  Department  of  Public  Safety  payroll  is  prepared 
by  a  Clerk  III  who  is  directly  supervised  by  the  Assistant  Director 
of  Public  Safety.  The  prepared  attendance  forms  along  with 
supporting  documentation  is  given  to  the  Assistant  Director  for 
verification  and  signature  approval.  In  the  absence  of  the 
Assistant  Director,  the  Associate  Director  is  the  alternate 
signature  authority.  The  payroll  checks  are  received  by  the 
Assistant  Director.  Each  check  is  recorded  on  a  log  that  the 
employee  is  required  to  sign  and  date  upon  receipt  of  the  check. 
Checks  remaining  unclaimed  after  three  working  days  are  mailed  via 
registered  mail  to  the  employee's  address. 

2.  Guidelines  have  been  prepared  .  and  are  being  reviewed  prior  to 
implementation. 

3.  We  will  establish  a  procedure  to  visit  departments  on  campus  to 
solicit  comments  and  answer  questions  on  payroll  policies  and  the 
distribution  of  pay  checks.  The  monitoring  to  assure  compliance 
with  the  policies  and  procedures  is  an  internal  audit  function. 

h.  When  applicable,  the  University  has  always  worked  with  the  State 
Board  of  Retirement  in  cases  where  attachments  of  retirement  funds 
may  be  necessary.  Prior  to  initiating  such  action,  we  must  have 
just  cause.  Since  there  was  no  action  pending  against  this 
individual,  no  contact  was  made  with  the  State  Board  of  Retirement 
prior  to  her  resignation. 

The  university  treasurer  responded  to  Recommendation  No.  4,  concerning  the 

bonding  company,  as  follows: 

We  concur  with  the  audit  finding  that  the  insurance  carrier  must  be 
notified  in  a  timely  manner.  Accordingly  all  budgetary  departments 
will  be  directed  to  contact  the  University  Treasurer  immediately  upon 
any  indication  of  a  potential  loss  of  funds.  In  this  case  we  did,  in 
fact  notify  the  insurance  carrier  upon  our  notification,  although  not 
within  the  thirty-day  period  required,  but  prior  to  the  state  audit 
inquiry.  It  should  be  noted  that  a  period  greater  than  thirty  days 
had  passed  since  the  problem  was  detected  by  University  personnel. 
Further,  the  "loss"  stated  in  the  report  is  subject  to  a  deductible 
of  $5,000  per  incident,  which  would  reduce  the  potential  loss.  The 
audit   report   also  assumes    that   the   potential    loss   of   funds   are  not 
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retrievable  from  any  other  source  or  means.     It  also  assumes  that  the 
claim  would  have  been  honored  in  full  by  the  insurance  carrier. 

The      university's      audit      liaison      provided      an      overall  university 

administration  response,  which  states,  in  part: 

In  my  role  as  University  Audit  Liaison,  I  will  convene  a  special 
meeting  of  campus  controllers  and  representatives  of  the  Treasurer's 
Office  to  discuss  and  clarify  the  controllers'  role  relative  to 
management  policies  and  procedures  that  affect  the  important  issues 
raised  in  the  findings.  We  will  reiterate  those  policies  to  the 
departmental  managers  at  each  campus. 

Auditor's  Reply;  The  university  indicated  in  its  response  that  contact 
was  not  made  with  the  State  Board  of  Retirement  because  of  the  lack  of  just 
cause  and  no  action  was  pending  against  the  individual.  However,  as 
previously  noted  in  our  review,  the  employee,  upon  detection  of  the  theft  by 
the  university,  acknowledged  responsibility  for  the  stolen  funds  and 
immediately  resigned.  Further,  the  employee  was  subsequently  indicted  for  the 
embezzlement,  and  as  of  January  18,  1991  the  case  was  pending  in  Hampshire 
Superior  Court.  Therefore,  UMA  personnel  should  have  notified  the  State  Board 
of  Retirement  concerning  the  feasibility  of  seeking  the  attachment  action. 

The  university  also  indicated  in  its  response  that  the  bonding  company  was 
not  notified  in  a  prompt  manner  because  more  than  30  days  had  passed  since  the 
problem  was  detected  by  xiniversity  personnel.  However,  although  the 
university,  through  its  Department  of  Public  Safety,  detected  the  theft  on 
April  1990,    the    university    treasurer,    who    has    the    responsibility  for 

notifying  the  bonding  company,  was  not  made  aware  of  the  problem  until  about 
the  second  week  of  June  1990.  As  we  stated  in  our  recommendation,  the 
university  should  improve  its  system  of  internal  controls  to  ensure  that 
prompt  action  is  taken  to  notify  the  university  treasurer  when  a  loss  of  funds 
is  detected  so  that  the  treasurer  can  promptly  contact  the  bonding  company. 
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